David Sancho
19 articles
-
ResearchWhat Cybercriminals Look For in Corporate Insiders
The supply and demand for insider threat actors have evolved from isolated opportunism into a structured, thriving criminal market, complete with brokers, recruiters, referral bonuses, guarantor services, and revenue-sharing arrangements. This research examines that market across different industries.
August 4th, 2026Mayra Rosario Fuentes, Stephen Hilt, David Sancho
Read article -
ResearchFrom Stealers to Systems: The New Model of Credential Theft
Tightening security controls and other underground factors are forcing infostealer operations to adapt. TrendAI™ Research explores their evolution into coordinated attack infrastructure and the implications for identity defense.
April 21st, 2026 21 minChristopher Boyton, David Sancho, Bakuei Matsukawa
Read article -
ResearchFrom Holiday Snap to Custom Scam in 30 Minutes: How AI Turns Public Photos Into Targeted Attacks
AI now enables attackers to rapidly convert publicly shared personal images into scalable, highly targeted phishing intelligence, turning everyday online photos into a significant and often overlooked security risk for individuals and enterprises.
February 24th, 2026 12 minNumaan Huq, David Sancho
Read article -
ResearchFrom LinkedIn to Tailored Attack in 30 Minutes: How AI Accelerates Target Profiling for Cybercrime
The industrialization of AI-driven OSINT has transformed individual digital footprints into machine-readable intelligence at scale, enabling attackers to operationalize personalized reconnaissance at volume.
February 23rd, 2026 11 minNumaan Huq, David Sancho
Read article -
ResearchThe Devil Reviews Xanthorox: A Criminal-Focused Analysis of the Latest Malicious LLM Offering
Xanthorox AI: flirty, menacing, and potentially devastating? We explored the inner workings of this LLM to unveil its devious capabilities for generating malicious code, obtaining private information, and roleplaying.
November 11th, 2025 15 minDavid Sancho, Vincenzo Ciancaglini, Salvatore Gariuolo
Read article -
ResearchDeepfake It ‘til You Make It: A Comprehensive View of the New AI Criminal Toolset
This report takes a comprehensive look at how deepfakes are used to support criminal business processes, what are the toolkits criminals are exploiting to power their deepfake creation, and what the deepfake underground looks like.
July 9th, 2025David Sancho, Salvatore Gariuolo, Vincenzo Ciancaglini
Read article -
ResearchUnderstanding Hacktivists: The Overlap of Ideology and Cybercrime
Hacktivist groups are driven by a political or ideological agenda. In the past, their actions were likened to symbolic, digital graffiti. Nowadays, hacktivist groups resemble urban gangs. Previously composed of low-skilled individuals, these groups have evolved into medium- to high-skill teams, often smaller in size but far more capable.
February 4th, 2025 17 minDavid Sancho
Read article -
ResearchAcross the Span of the Spanish Cybercriminal Underground: Current Activities and Trends
What does the present state of the Spanish-speaking cybercriminal underground look like? What are the most common scams and other illicit offerings peddled by cybercriminals? Unearth the secrets of the Spanish dark market in our research.
January 30th, 2025 18 minMayra Rosario Fuentes, David Sancho
Read article -
ResearchGenerative AI in Elections: Beyond Political Disruption
Elections are not just an opportunity for nation states to use Generative AI tools to damage a politician’s reputation. They are also an opportunity for cybercriminals to use Generative AI tools to orchestrate social engineering scams.
October 24th, 2024 9 minDavid Sancho, Vincenzo Ciancaglini
Read article -
ResearchSurging Hype: An Update on the Rising Abuse of GenAI
The cybercriminal abuse of generative AI (GenAI) is developing at a blazing pace. After only a few weeks since we reported on Gen AI and how it is used for cybercrime, new key developments have emerged. Threat actors are proliferating their offerings on criminal large language models (LLMs) and deepfake technologies, ramping up the volume and extending their reach.
July 30th, 2024 9 minDavid Sancho, Vincenzo Ciancaglini
Read article -
ResearchBack to the Hype: An Update on How Cybercriminals Are Using GenAI
Generative AI continues to be misused and abused by malicious individuals. In this article, we dive into new criminal LLMs, criminal services with ChatGPT-like capabilities, and deepfakes being offered on criminal sites.
May 8th, 2024 12 minVincenzo Ciancaglini, David Sancho
Read article -
ResearchYour Stolen Data for Sale
In today’s rapidly evolving digital landscape, the risk of personal and professional data being stolen by nefarious actors looms larger than ever. This report lays bare the stark reality of this threat, with a specific focus on the unequal risks associated with data theft and its subsequent misuse.
November 13th, 2023 19 minDavid Sancho, Vincenzo Ciancaglini
Read article -
ResearchHype vs. Reality: AI in the Cybercriminal Underground
This report discusses the state of generative artificial intelligence (AI) in the cybercriminal underground: how cybercriminals are using ChatGPT, how they're adding ChatGPT features to their criminal products, and how they’re trying to remove censorship to ask ChatGPT anything.
August 15th, 2023 17 minDavid Sancho, Vincenzo Ciancaglini
Read article -
ResearchInside the Halls of a Cybercrime Business
We explore three differently sized criminal groups to determine how they compare to similarly sized legitimate businesses in terms of how they are organized. We also discuss the advantages of knowing the size of a target criminal organization for cybercrime investigators.
April 3rd, 2023 6 minDavid Sancho, Mayra Rosario Fuentes
Read article -
ResearchThe Future of Ransomware
Our research looks at the potential evolutions and revolutions in the current ransomware landscape based on significant triggers and catalysts. We highlight the specific developments (triggers) that could cause gradual changes (evolutions) before sparking more drastic transformations (revolutions).
December 15th, 2022 9 minFeike Hacquebord, Stephen Hilt, David Sancho
Read article -
ResearchFrom Bounty to Exploit: Cybercriminals Use Crowdsourcing for New Attacks
From articles to hackathons, cybercriminals are resorting to crowdsourcing to find more ways to exploit systems. In this article, we tackle these contests, explore their results, and anticipate their possible impacts on the work of cybersecurity defenders.
October 20th, 2022 13 minDavid Sancho
Read article -
ResearchThe Crypto-Monetized Web: A Forward-Looking Thought Experiment
In past decades, we have seen how the web has drastically evolved. From the static, read-only version of Web 1.0, we have witnessed its transformation to its present mode — as the dynamic, interactive, and content creator-driven iteration that is Web 2.0.
June 30th, 2022 26 minDavid Sancho
Read article -
ResearchUncovering IoT Threats in the Cybercrime Underground
Understanding current and future threats to the internet of things (IoT) can help shape how we secure this technology that is increasingly becoming integral to today's world. What insights can be reaped from the cybercrime underground?
September 10th, 2019 3 minStephen Hilt, Vladimir Kropotov, Fernando Mercês, Mayra Rosario…
Read article -
ResearchCrimeware for Sale: The Commoditization of ATM Malware in the Cybercriminal Underground
Criminal sellers are peddling ready-to-use ATM malware in underground markets for hacking into banks. In this report, we discuss how criminals advertise and even provide instructions on how to pull off a digital heist.
June 28th, 2019 6 minNumaan Huq, Vladimir Kropotov, Mayra Rosario, David Sancho…
Read article